WO2007052388A1 - Method of protecting confidential file and confidential file protecting system - Google Patents

Abstract

A method of protecting confidential files is provided to definitely protect business confidential files in accordance with a security policy. In the method of protecting confidential files, a management server registers in advance information of business applications to allow an access to confidential files and the information of such registered applications is distributed to each client as needed. When a business application refers to confidential files, it is judged (application is authenticated) at a starting-up time of a business application if the application is registered in advance in the server, and its own process information is registered in an I/O acquisition module only when the application is successfully authenticated. In the I/O acquisition module, the access to confidential information is permitted only in the case that a process is consistent with the registered process information, and any access is otherwise rejected.

Description

 Specification

 Confidential file protection method and confidential file protection system

 Technical field

 [0001] The present invention relates to a method and system for protecting a business confidential file by controlling access to confidential information of a business application in units of applications or processes.

 Background art

 In recent years, there have been many incidents of leakage of important personal information such as leakage of customer information, and protection of customer information has become a major concern for companies.

[0003] In addition, since April 2005, the Personal Information Protection Law has been fully enforced for private businesses, and interest in security countermeasure applications is rapidly increasing.

[0004] In security countermeasure applications, confidential information that you do not want to leak outside the business

 It is important to protect confidential information (such as operating environment definition information and policy definition information) of the security countermeasure application itself (such as data containing personal information).

[0005] There is a technique described in Patent Document 1 below as a method for authenticating an application that can access a confidential file.

[0006] In this technology, API issue events from business applications are captured by the filter module, and application authentication is performed while file I / O issuance is temporarily suspended. File I / O from permitted business applications is permitted by the I / O monitoring module, and unauthorized file I / O is rejected.

 Patent Document 1: Japanese Patent Laid-Open No. 2003-108253

 Disclosure of the invention

 Problems to be solved by the invention

[0007] When handling confidential information including personal information, there are cases in which access to the confidential information is permitted only in a specific business application and it is not desired to allow access to other applications. For example, if you only want to refer to a confidential file, you can only refer to it in a specific view. In order to prevent leakage of information, other applications may prohibit access to confidential files.

 [0008] Further, in a security countermeasure application, it is a dangerous attack to analyze and tamper with a confidential file storing confidential information such as the security countermeasure application operating environment and policy definition information. For example, even if a client has a policy that prohibits any network or external media from being taken out, confidential information can be taken out freely if the policy definition information is rewritten by a malicious third party. It will be possible.

 [0009] The technique described in Patent Document 1 is a technique suitable for an access control mechanism when a business application refers to / updates a business document, a table file, and the like.

 [0010] However, there are the following problems to satisfy the above requirements.

 [0011] Since one is an external authentication method that captures API issuance events, the communication process between the filter module that captures API issuance events and the application authentication module, and the application authentication module and I / O monitoring module Communication processing occurs, and the performance deteriorates compared to the implementation with internal code. Even if the application authentication is limited to capture only the API of the file OPEN, the performance of the application is unavoidable because the file OPEN is normally issued multiple times.

 [0012] Second, the contents of the hash management table in which application information for permitting access to a confidential file is registered can be altered. When applying a security policy that controls access to confidential files on an application-by-application basis, the security administrator should centrally manage the security policy in the network group, and that information cannot be tampered with by the client. Should.

 [0013] An object of the present invention is to dynamically perform application authentication in a security countermeasure application, suppress performance degradation of the security countermeasure application, and securely protect confidential business files according to the security policy within the group. It is to provide a method and system for protecting confidential files.

 Means for solving the problem

[0014] In order to achieve the above object, the confidential file protection method according to the present invention is not suitable for business purposes. An application management table that protects a confidential file that is prohibited from being accessed correctly, and that is stored in an application management service that runs a business application requesting access to the confidential file on a server computer. A second step of registering in the client computer, and a second step of running on the client computer and communicating with the application management service of the server computer and caching the contents of the application management table in the client computer. If the application and the business application are business applications registered in the application authentication information cached by the application authentication service, the business application is executed. The third step in which the installed application authentication module registers the process of the business application in the process management table of the process authentication 'file I / O capture module running on the client, and the process authentication' file I / O Capturing module capability In response to an access request to the confidential file, the access request is captured, and it is determined whether the access request source process is a process registered in the process management table. And a fourth step of prohibiting access to the access and permitting access if registered.

 [0015] In the first and third steps, information on the access authority and access period for the confidential file is registered in the application management tape record and process management table. In the fourth step, It is characterized by permitting access to confidential files only for the registered access authority and accessible period.

[0016] Further, the confidential file protection system according to the present invention is a confidential file protection system that protects a confidential file by prohibiting unauthorized access for business purposes. The first registration means for registering the application in the application management table held by the application management service running on the server computer and the application authentication service running on the client computer are the application management service of the server computer. Means for caching the contents of the application management table in a client computer, and the business application is cached by the application authentication service. If it is a business application registered in the registered application authentication information, the application authentication module installed in the business application identifies the process of the business application as a process authentication file I / The second registration means for registering in the process management table of the O capture module, and the process authentication 'file I / O capture module power for the access request to the confidential file, the access request is captured and the process of the access request source Access permission means for determining whether the process is registered in the process management table, prohibiting access to the confidential file if not registered, and permitting access if registered. It is characterized by.

Further specific configurations of the invention will become apparent from the following best mode for carrying out the invention and the accompanying drawings.

 The invention's effect

 [0018] According to the present invention, an application authentication module for authenticating a business application with an application authentication service for authenticating an access right to a confidential file is implemented in the business application, and the application authentication module Since it is configured to allow access to the confidential file only when the access right to the confidential file has been registered by communication between the application authentication service and the application authentication service, implement the application authentication module! /, N / A, unauthorized applications will not be able to access sensitive files. This makes it possible to reliably protect the confidential file from unauthorized access to the confidential file by an unauthorized application.

 [0019] Since this application authentication is an authentication method that does not depend on an API issuance event, it is possible to reduce the frequency of issuance of authentication requests and implement performance that does not degrade performance as much as possible. In addition, since access control is realized by filtering file I / O on a process basis, process authentication occurs every time file I / O occurs. Since it can be realized only by simple comparison and judgment with a unique identifier such as an ID, it can be implemented without causing a large performance degradation.

[0020] Further, the application authentication service of the client computer is always in operation, and communicates with the application management service of the server computer at any time. Since the contents of the application management table held by the computer are cached in the memory, it is not necessary to inquire the server computer every time the application is authenticated, and performance degradation can be suppressed.

 [0021] In particular, when the application authentication information is stored in the memory, it is configured to store the application authentication information in a volatile memory where the memory contents are erased when the power is turned off. There is less risk of tampering, and even if the client computer is stolen, once the client computer is shut down, the cached application authentication information will be erased, so there is less risk of misuse!

 [0022] The security administrator registers the application on the server computer, manages the application authentication information in the server computer, and distributes it to the client computer. Therefore, the access authority and access of each application in the same network group. You can specify the possible period etc. at once.

 In the present invention, the same security policy can be applied within a network group, and a function for centrally managing the policy can be provided.

 [0024] This specification includes the contents described in the specification and Z of the Japanese Patent Application No. 2005-319156, which is the basis of the priority of the present application.

 Brief Description of Drawings

 FIG. 1 is a functional block diagram showing an embodiment of the present invention.

 FIG. 2 is a table for explaining a schematic configuration of application management information.

 FIG. 3 is a table for explaining a schematic configuration of application information.

 FIG. 4 is a table for explaining a schematic configuration of process management information.

 FIG. 5 is a table for explaining a schematic configuration of process information.

 FIG. 6 is a diagram for explaining a schematic configuration of an application registration method.

 FIG. 7 is a diagram for explaining a schematic configuration of a distribution method of application authentication information.

 FIG. 8 is a diagram for explaining confidential file access of an authenticated application.

 FIG. 9 is a diagram for explaining confidential file access by an unauthorized application.

FIG. 10 is a flowchart showing an outline of a procedure from when an application requests authentication to access a confidential file. FIG. 11 is a flowchart showing a procedure of application authentication processing in the application authentication service.

 [Fig. 12] Process authentication 'This is a flowchart showing the processing procedure for registering a process by the file I / O capture module.

 FIG. 13 is a flowchart for explaining file I / O capture of the process authentication 'file I / O capture module.

[14] FIG. 14 is a diagram showing another embodiment to which the present invention is applied.

 FIG. 15 is a table for explaining a schematic configuration of application information of application 1;

 FIG. 16 is a table for explaining a schematic configuration of application information of application 2;

Explanation of symbols

 1 Client computer

 7 memory

 8 Server computer

 101 Business application

 102 Application Authentication Service

 103 Process authentication 'file I / O supplement module

 104 Application management services

 105 Application authentication module

 106 Application authentication information

 107 Access management table

 109 Confidential file

 110 General files

 306, 1506, 1606 Accessible period

 307, 1507, 1607 access rights

 1508, 1608 Access permission file path name

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, an embodiment in the case of carrying out the present invention will be specifically described with reference to the drawings.

 FIG. 1 is a functional block diagram showing an embodiment of a system (confidential file protection system) to which the present invention is applied.

 [0029] The client computer (confidential file protection device) 1 includes a keyboard 2, a mouse 3, a display 4, a CPU 5, an external storage device 6, and a memory 7. The memory 7 includes business applications 101 used for various business operations. It is remembered.

 [0030] Furthermore, a process authentication 'file I / O acquisition module 103 for protecting the confidential file 109 is stored.

 [0031] The process authentication 'file I / O capture module 103 includes a process management table 107, captures process registration and file I / O instructions, and uses process information stored in the process management table 107 to manage the process. Authentication is performed, and access to the confidential file 109 is not permitted for file I / O commands from processes for which authentication is denied. Conversely, for file I / O commands from applications that are permitted to authenticate, access to the confidential file 109 is permitted only for the access authority and access time registered in the process management tape 107.

 [0032] The application authentication service 102 holds (caches) the application authentication information 106 in a memory. This application authentication information 106 is the latest information acquired from the application management table 108 of the server computer 8 through the application management service 104 of the server computer 8 as needed, and the business application that the server computer 8 has granted access to the confidential file 109. It is information about.

 [0033] When there is a request for application authentication from the application authentication module 105 installed in the business application 101, the application authentication service 102 performs application authentication based on the application authentication information 106, and authentication is performed. If permitted, the process information of the application whose authentication is permitted is registered in the process management table 107, and the subsequent access control is left to the process authentication 'file I / O capturing module 103. On the other hand, if authentication is rejected, nothing is done.

[0034] The application management service 104 of the server computer 8 includes an application management table 108, which is a business application that allows access to the confidential file 109. The registration status by the administrator is monitored, and the application information registered in the application management table 108 is distributed to the client computer 1 as necessary. When an administrator requests registration of an application, the application information (information shown in FIG. 3) is registered in the application management table 108.

 [0035] The confidential file 109 is a file that stores confidential information such as confidential information that is prohibited to be taken out, security environment application operation environment definition information, and policy definition information. . The general file 110 is a file other than the confidential file 109. Note that the security countermeasure application is an application for prohibiting the disclosure of various data including the general file 110 to the outside or taking it out. In the present invention, the operating environment definition information and policy definition of the security countermeasure application are defined. Protects confidential information such as information from being tampered with or leaked, and prevents the security functions of security countermeasure applications from degrading.

 FIG. 2 is a diagram showing an example of the storage contents (application authentication information) of the application management table 108 held by the application management service 104 of the server computer 8. The number of applications permitted to access the confidential file 109 (the number of applications to be registered) 201 and the application information 202 including the access authority related to the application are registered.

 [0037] As shown in FIG. 3, the application information 202 includes an application name 301 that permits access to the confidential file 109, an application version 302, a nose value 303, an application registration date and time 304, an application use time limit 305, It consists of an accessible period 306 and an access authority 307. The hash value is a value obtained by a hash function that generates a fixed-length pseudorandom number from given data, and it is extremely difficult to create different data with the same hash value.

 The hash value 303 is a value generated from the binary data of the execution program file of the business application 101 using a hash function. When the business application 101 is authenticated, the business application 101 is used to determine whether the business application 101 is a correct business registration registered in the server computer 8.

[0039] FIG. 4 shows the process management test held by the process authentication 'file I / O capture module 103. Is a diagram showing an example of the records and contents of one table 107. The process information 402, which consists of the number of processes (number of registered processes) 401 that allow access to the confidential file 109 and the process identifier for that process, is registered. Has been.

As shown in FIG. 5, the process information 402 includes a process name 501, a process identifier 502, a process registration date and time 503, and an accessible period 50 that permit access to the confidential file 109.

4. It consists of access authority 505.

[0041] The process identifier 502 represents a process-specific value added by the OS (operating system) of the client computer 1, such as a process ID.

FIG. 6 is a diagram showing a flow of registering the business application 101 that permits access to the confidential file 109 in the application management service 104 running on the server computer 8.

 In FIG. 6, the administrator performs user authentication for the application management service 104 using a preset user name and password. When the user authentication is successful, each information such as the application name, application version, hash value, application expiration date, and access authority of the registered business application 101 is stored in the application management table 108 through the application management service 104.

 [0044] If the application information passed to the application management service 104 is incomplete or the same information has already been registered, the result of the registration error is returned to the application registration command 601. If registration is completed without problems, the result of successful registration is returned.

 FIG. 7 is a diagram showing a flow of obtaining the latest application authentication information 106 held by the application authentication service 102 S running on the client computer 1 and the server computer 8.

The application authentication service 102 receives application information from the server computer 8 as needed, and caches the latest application authentication information 106. The latest application information 106 is acquired at the time of OS startup or OS login to avoid redundant communication with the server computer 8. Alternatively, it is updated when the latest application authentication information 106 is distributed from the server computer 8. When acquiring the latest application authentication information 106, an acquisition request is made to the application management service 104, and the application authentication information 106 is acquired through the application management service 104.

 FIG. 8 is a diagram showing a mechanism in which the authenticated business application 101 refers to the confidential file 109.

 [0049] In the example of FIG. 8, the authenticated business application 101 has been authenticated to the process authentication 'file I / O capture module 103 through the application authentication module 105 and the application authentication service 102, and the process information is stored in the process management table 107. Already registered.

 When the business application 101 accesses the confidential file 109, a file I / O command for the confidential file 109 is issued.

 [0051] Process authentication 'The file I / O capture module 103 captures the file I / O instruction, and searches the process management table 107 for the process of the requesting business application 101. Since it has already been registered, access to the confidential file 109 is permitted within the range of access authority and within the accessible period according to the process information registered in the process management table 107.

 FIG. 9 is a diagram showing a mechanism for prohibiting unauthorized application 901 from accessing confidential file 109.

 The unauthorized application 901 cannot perform application authentication because it does not have the application authentication module 105. Therefore, the process information of the unauthorized application 901 is not registered in the process management table 107.

 When the unauthorized application 901 accesses the confidential file 109, a file I / O command for the confidential file 109 is issued. Process authentication. File I / O capture module 10 3 captures the file I / O instruction, and searches the process management table 107 for the process of the requesting unauthorized application 901. Since the process of the unauthorized application 901 is registered, the file I / O command is returned to the request source as an error.

Accordingly, access to the confidential file 109 from the unauthorized application 901 is prohibited. [0056] FIG. 10 is a flowchart showing an outline of the procedure from when the business application 101 registers a process to the process authentication 'file I / O capture module 103 and whether or not access to the confidential file 109 is determined. It is.

 [0057] Before accessing the confidential file 109, the business application 101 uses the process authentication 'file I / O capture module 103, such as the process name used by itself and the period during which the confidential file can be accessed. It is necessary to register the indicated process information.

 [0058] First, the application authentication module 105 of the business application 101 obtains the application name of the business application necessary for authenticating the business application 101 from the execution file name of the business application, and the version resource of the execution file. (Step 1101). Also, a hash value is calculated (step 1002). Then, an application authentication request is issued to the application authentication service 102 (step 1003), and information such as version and hash value is transmitted (step 1004).

 [0059] The application authentication service 102 compares the information received from the application authentication module 105 with the cached application authentication information 106, and the business application 101 can access the confidential file on the server computer 8. It authenticates whether it is a permitted business application, and returns the authentication result to the application authentication module 105 (step 1005).

 [0060] If the authentication fails (if access to the confidential file is prohibited), the application authentication module 105 terminates without doing anything.

If the authentication is successful, the application authentication service 102 issues a process registration request to the process authentication 'file I / 0 capture module 103 (step 1007). Then, the process identifier, access authority, etc. are acquired and transmitted, and registered in the process management table 107. Note that the OS identifier can be acquired for the process identifier of the process being executed. The application authentication service 102 receives the process authentication for this, receives the registration result from the file I / O capture module 103 (step 1009), and if a response indicating successful registration is returned, the application authentication service 102 accesses the confidential file 109. Enable (step 1011). Registration If unsuccessful, access to the confidential file 109 is prohibited (step 1012).

) o

 Note that the process identifier registered in the process management table 107 in FIG. 5 is obtained from the OS, and the process name and access authority are input from the cached application information 202 (here, Process name 501 inputs application name 301). The process registration date / time is the process authentication / file I / O acquisition module 103 registered by acquiring the current date / time from the clock power of the client computer 1. The access period and the access authority are those that the application authentication service 102 extracts from the application authentication information 106 and sends it to the process authentication 'file I / O capture module 103.

 FIG. 11 is a flowchart showing a processing procedure for the application authentication service 102 to authenticate an application and a processing procedure for acquiring the application authentication information 106 from the server computer 8.

 [0064] When the application authentication service 102 is started, it waits for an application authentication request (step 1101). When an application authentication request is received from the application authentication module 105 (steps 1102 and 1103), the application information such as the hash value and file version transmitted from the application authentication module 105 is searched from the cached application authentication information 106. Then, it is determined whether or not it has been registered (step 1104). If it is not registered, the authentication failure result is returned to the request source. If registered, the process information of the business application 101 is obtained from the OS and application information 202 (step 1106), and the process is registered in the process authentication 'file I / O capture module 103 (step 1107). The registration result is returned to the request source (step 1108).

 [0065] When the application authentication service 102 detects the OS logon (step 1109), it acquires the latest application authentication information 106 from the management server (step 1110).

) o

FIG. 12 is a flowchart showing a processing procedure in which the process authentication 'file I / O capturing module 103 registers a process. [0067] Process Authentication When the file I / O capture module 103 is started, a process registration request from the application authentication service 102 is awaited (step 1201). When a process registration request is received (step 1202), the request type is confirmed (step 1203).

 [0068] If the request type is "Registered", the process information such as the process identifier such as the process identifier is acquired from the OS and application information 202 (Step 1204), and the same process is not registered in the process management table 10 7 (Step 1205). If not registered, the acquired process information is registered in the process management table 107 (step 1206). If it has been registered, the acquired process information is not registered. A successful or unsuccessful response of the registration result is returned to the request source (step 1207).

 [0069] If the request type is "deregistration", process information such as the request source process identifier is acquired (step 1208), and the acquired process identifier is deleted from the process management table 107 (step 1209).

 FIG. 13 is a flowchart showing a procedure for the process authentication 'file I / O capturing module 103 to capture the access of the confidential file 109 and perform access control.

 [0071] When the process authentication 'file I / O capture module 103 is started, a file I / O command is awaited as a file I / O capture function (step 1301). When a file I / O command such as a file OPEN request is captured (step 1302), it is checked whether the I / O command is a request for the confidential file 109 (step 1303). If the command is an I / O command for the confidential file 109, a search is further performed to determine whether the process of the application that issued the file I / O command is registered in the process management table 107 (step 1304). If it is a file I / O command from the process of the authenticated application, access control is performed according to the access authority of the process information registered in the process management table 107 (step 1305).

 [0072] For example, a business application having access authority only for reading can only refer to the confidential file 109. Also, the confidential file 109 can be edited from a business application to which write authority is given.

[0073] Note that the process name and process identifier of the application that issued the file I / O instruction are included in the file I / O instruction, and are registered in the process management table 107 accordingly! / Determine whether access is from a process. FIG. 14 is a diagram showing another embodiment to which the present invention is applied.

 In this embodiment, the applications 1401 and 14 having the application authentication modules 1403 and 1404 having the same function as the application authentication module 105 of FIG.

There is 02.

 Access to the confidential files 1405 and 1406 is controlled by the process authentication file I / O capturing module 103 as files for storing confidential information.

 [0077] When the file path name allowing access to the authentication information in FIG. 3 can be specified, the application information for the application 1401 in the application management table 108 becomes, for example, as shown in FIG. 15, and the application 1401 has its own confidential information. An authentication request can be issued so that only file 140 5 (file path name “C: \ secret \ secret file 1.txt”) can be accessed.

 Similarly, the application information for the application 1402 in the application management table 108 is as shown in FIG. 16, for example. The application 1402 has its own confidential file 1406 (file path name “C: \ secret \ confidential file 2. doc ") can be issued so that it can only be accessed.

 [0079] In the case of FIG. 14, when the application 1402 tries to access the confidential file 1405 held by the application 1401, the confidential file 1405 file path is included in the access permission file path name 1608 in its own application information (FIG. 16). Since the name “C: \ secret \ confidential file 1.txt”) is not included, it is determined in step 1305 of the access control procedure that there is no access authority, and the confidential file 1405 cannot be accessed. Similarly, when the application 1401 tries to access the confidential file 140 6 held by the application 1402, the confidential file 1406 file path name “C: ¥” is added to the access permitted file path name 1508 in its application information (FIG. 15). secret \ confidential file 2. doc ") is not included, it is determined in step 1305 of the access control procedure that there is no access authority, and the secret file 1406 cannot be accessed. In this way, fine access control can be realized by separating sensitive files accessible by application.

[0080] It should be noted that all publications, patents and patent applications cited in this specification are referred to as they are. And are incorporated herein.

 The present invention is not limited to the above-described embodiments disclosed above, and can be reconfigured, modified, and substituted without departing from the scope defined by the claims.

Claims

The scope of the claims  [1] A method for protecting a confidential file that is prohibited from unauthorized access for business purposes, wherein the business application that requested access to the confidential file is an application management service running on a server computer A first step of registering with the application management table maintained by  A second step of communicating with an application management service of the server computer and caching the contents of the application management table in the client computer; and If it is a business application registered in the application authentication information cached by the service, the application authentication module installed in the business application will change the process of the business authentication to the process authentication 'file running on the client computer. The third step of registering in the process management table of the I / O capture module and the process authentication 'file I / O capture module force In response to an access request to a dense file, the access request is captured and it is determined whether the access request source process is a process registered in the process management table. If it is not registered, access to the confidential file is performed. A fourth step to prohibit and allow access if registered A method for protecting a confidential file, comprising: [2] In the first and third steps, register the access authority and access period information for confidential files in the application management table and process management table,  2. The method for protecting a confidential file according to claim 1, wherein in the fourth step, access to the confidential file is permitted only for a registered access right and an accessible period.  [3] In the first and third steps, register the access permission file path name in the application management table and the process management table. In the fourth step, registered access authority, accessible period, and 3. The method for protecting a confidential file according to claim 2, wherein access to the confidential file is permitted only for an access-permitted file path name. [4] A confidential file protection system that protects confidential files by prohibiting unauthorized access in business,  A first registration means for registering a business application requesting access to the confidential file in an application management table held by an application management service running on a server computer;  An application authentication service that runs on a client computer, communicates with an application management service of the server computer, and caches the contents of the application management table in the client computer;  If the business application is a business application registered in the application authentication information cached by the application authentication service, the application authentication module installed in the business application operates the business authentication process on the client computer. Process authentication 'file I / O capture module's second registration means to register in the process management table, and the process authentication' file I / O capture module power Captures the request and determines whether the access request source process is a process registered in the process management table. If it is not registered, access to the confidential file is prohibited, and if it is registered, access is permitted. Access permission means,  A confidential file protection system comprising: [5] The first registration means registers the access authority to the confidential file and the information on the accessible period in the application management table, and the second registration means registers in the process management table.  5. The confidential file protection system according to claim 4, wherein the access permission means permits the access to the confidential file only for the registered access authority and the accessible period. [6] The first registration means is a second registration means for the application management table. Further registers an access-permitted file path name in the process management table, and the access-permitting means limits the access to the confidential file only to the registered access authority, accessible period, and access-permitted file path name. 6. The confidential file protection system according to claim 5, wherein access is permitted.